CVE Intelligence
Analysis AI-assisted

CVE-2026-0579: code-projects Online Product Reservation System SQL Injection in POST Parameter Handler (edit.php)

CVE-2026-0579 is an SQL injection vulnerability in code-projects Online Product Reservation System 1.0, affecting the administrative file /handgunner-administrator/edit.php. The VulDB record states that the prod_id, name, price, model and serial arguments can be manipulated remotely, and a public proof-of-concept reference is listed, but no confirmed exploitation in the wild appears in the sources consulted. No fix is listed in the record, so administrators should restrict access to the affected page and review their deployment.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0579 is classified as an injection issue (CWE-74) in code-projects Online Product Reservation System 1.0. According to the VulDB entry, the problem is in an unspecified part of /handgunner-administrator/edit.php, within a component described as POST Parameter Handler, where the prod_id, name, price, model and serial arguments can be manipulated to cause SQL injection. The record was published on 2026-01-04 and analyzed by VulDB. See the VulDB entry and the NVD record.

Impact

  • NVD assigns a CVSS base score of 9.8 (critical). Its vector describes a network-reachable attack with low complexity, no privileges required and no user interaction.
  • Other providers in the record assign lower scores, from 5.5 to 7.5. Scores vary by provider and scoring version.
  • SQL injection on an administrative page can expose or alter data in the backing database. The exact data affected is not stated in the record.

Affected products and versions

  • Code-projects Online Product Reservation System, version 1.0.
  • Fabian Online Product Reservation System, version 1.0, also listed in the record.
  • The record does not list a fixed version or a vendor patch. Whether a fix exists is unknown from the sources consulted.

Exploitation status

CISA KEV does not list this CVE, so it is not recorded as actively exploited in the KEV catalog. The record references a public third-party write-up tagged as an exploit, which indicates a public proof of concept exists (reference). The SSVC data in the record marks exploitation as proof-of-concept level. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00435 (percentile 0.3676).

Remediation and mitigation

  • No vendor fix is listed. Treat the application as unpatched until the developer or your own code review confirms otherwise.
  • Restrict access to the /handgunner-administrator/ path to trusted networks or require strong authentication in front of it.
  • Remove the application from internet-facing systems if it is not actively needed.
  • Have a developer review how the affected parameters reach database queries and move to parameterized queries with server-side input validation.
  • Limit database account privileges used by the application to the minimum required.

Detection guidance

  • Review web server and application logs for requests to the administrative edit page that contain unusual characters or unexpected parameter values.
  • Watch for database errors originating from the application and unexpected changes to product records.
  • Check whether the application is deployed and at which version, as the record only names version 1.0.

Limitations of the available information

The record describes the vulnerable location only as an unknown part of the file, so the exact vulnerable code path is not confirmed. No fixed version, vendor advisory or affected version range beyond 1.0 is provided. The EPSS date in the record is not used for analysis. Scores differ across providers and should be read together.

Frequently asked questions

Is CVE-2026-0579 known to be actively exploited?

CISA KEV does not list this CVE. The sources consulted reference a public proof of concept, but no confirmed exploitation in the wild appears in them.

Which versions are affected?

The record names code-projects Online Product Reservation System version 1.0 and Fabian Online Product Reservation System version 1.0. No fixed version is listed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.